Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-92173 | critical | 9.1 | No | Prior to v74.0.0.878.1682 of Meta Horizon OS, MediaSyncJobReceiver could be induced to send a privileged PendingIntent including a com.oculu... | 2026-10-01 |
| CVE-2026-51870 | critical | 9.8 | No | DeepTutor v1.4.0 is vulnerable to command execution in /tutorbot/agent/tools/shell.py:ExecTool.execute. | 2026-10-01 |
| CVE-2026-51864 | critical | 9.1 | No | DB-GPT v0.7.5 and v0.8.0 contains directory traversal in python_file_upload (packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/python_upload_a... | 2026-10-01 |
| CVE-2026-51859 | critical | 9.1 | No | bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to directory traversal in save_download_file (src/backend/bisheng/core/cache/utils.py:29... | 2026-10-01 |
| CVE-2026-51853 | high | 7.5 | No | agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in python/helpers/file_browser.py:FileBrowser.__init__. The FileBrow... | 2026-10-01 |
| CVE-2026-103532 | medium | 5.3 | No | A vulnerability has been found in immich-app Immich up to 2.7.5. This affects the function checkSharedLinkAccess of the file server/src/util... | 2026-10-01 |
| CVE-2026-103589 | medium | 5.4 | No | QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor that fails to escape room_... | 2026-10-01 |
| CVE-2026-103472 | high | 7.5 | No | restbed through 5.0.0 accepts WebSocket frames with declared payload lengths up to 2^63 bytes and buffers the payload without size limits in... | 2026-10-01 |
| CVE-2026-103048 | medium | 6.1 | No | URL redirection to untrusted site ('open redirect') vulnerability in The Wikimedia Foundation Mediawiki - Collection extension allows Fake t... | 2026-10-01 |
| CVE-2026-103044 | critical | 9.8 | No | XML injection (aka blind XPath injection) vulnerability in The Wikimedia Foundation Mediawiki - EasyTimeline extension allows XML Injection.... | 2026-10-01 |
| CVE-2026-102796 | high | 7.5 | No | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wikimedia Foundation Mediawiki - UserP... | 2026-10-01 |
| CVE-2026-101925 | medium | 6.4 | No | The bbp style pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name (via /wp-admin/profile.php) + bbp... | 2026-10-01 |
| CVE-2026-100242 | high | 7.5 | No | Dependency on Vulnerable Third-Party Component and Uncontrolled Resource Consumption vulnerability in Wikimedia Foundation Mediawiki - DataT... | 2026-10-01 |
| CVE-2026-100240 | critical | 9.1 | No | Missing Authorization vulnerability in Wikimedia Foundation Mediawiki - TemplateSandbox Extension allows Accessing Functionality Not Properl... | 2026-10-01 |
| CVE-2026-100723 | high | 7.5 | No | vm2 before 3.12.2 does not apply its Buffer backing-store ownership invariant (byteOffset === 0 and buffer.byteLength === length) to Buffers... | 2026-10-01 |
| CVE-2024-58387 | high | 7.5 | No | Inspur Haiyue HCM Cloud contains an arbitrary file read vulnerability in the /api/model_report/file/download endpoint that allows unauthenti... | 2026-10-01 |
| CVE-2024-9379 | high | 7.2 | Listed | SQL injection in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to ru... | 2026-10-01 |
| CVE-2025-0282 | critical | 9.0 | Listed | A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neu... | 2026-10-01 |
| CVE-2024-7399 | critical | 9.8 | Listed | Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1050 allows attack... | 2026-10-01 |
| CVE-2022-27925 | high | 7.2 | Listed | Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. An authen... | 2026-10-01 |